Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity

Back
Id779731f7-8ba0-4198-8524-5701b7defddc
RulenameM365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity
DescriptionThis content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.
SeverityMedium
TacticsPrivilegeEscalation
TechniquesT1078
Required data connectorsCheckPoint
Fortinet
OfficeATP
PaloAltoNetworks
Zscaler
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SucessfullSiginFromPhingLink.yaml
Version1.0.5
Arm template779731f7-8ba0-4198-8524-5701b7defddc.json
Deploy To Azure
let Alert_List= dynamic([
"Phishing link click observed in Network Traffic",
"Phish delivered due to an IP allow policy",
"A potentially malicious URL click was detected",
"High Risk Sign-in Observed in Network Traffic",
"A user clicked through to a potentially malicious URL",
"Suspicious network connection to AitM phishing site",
"Messages containing malicious entity not removed after delivery",
"Email messages containing malicious URL removed after delivery",
"Email reported by user as malware or phish",
"Phish delivered due to an ETR override",
"Phish not zapped because ZAP is disabled"]);
SecurityAlert
| where AlertName in~ (Alert_List)
//Findling Alerts which has the URL
| where Entities has "url"
//extracting Entities
| extend Entities = parse_json(Entities)
| mv-apply Entity = Entities on
    (
    where Entity.Type == 'url'
    | extend EntityUrl = tostring(Entity.Url)
    )
| summarize
    Url=tostring(tolower(take_any(EntityUrl))),
    AlertTime= min(TimeGenerated),
    make_set(SystemAlertId, 100)
    by ProductName, AlertName
// matching with 3rd party network logs and 3p Alerts
| join kind= inner (CommonSecurityLog
    | where DeviceVendor has_any  ("Palo Alto Networks", "Fortinet", "Check Point", "Zscaler")
    | where DeviceProduct startswith "FortiGate" or DeviceProduct startswith  "PAN" or DeviceProduct startswith  "VPN" or DeviceProduct startswith "FireWall" or DeviceProduct startswith  "NSSWeblog" or DeviceProduct startswith "URL"
    | where DeviceAction != "Block"
    | where isnotempty(RequestURL)
    | project
        3plogTime=TimeGenerated,
        DeviceVendor,
        DeviceProduct,
        Activity,
        DestinationHostName,
        DestinationIP,
        RequestURL=tostring(tolower(RequestURL)),
        MaliciousIP,
        SourceUserName=tostring(tolower(SourceUserName)),
        IndicatorThreatType,
        ThreatSeverity,
        ThreatConfidence,
        SourceUserID,
        SourceHostName)
    on $left.Url == $right.RequestURL
// matching successful Login from suspicious IP
| join kind=inner (SigninLogs
    //filtering the Successful Login
    | where ResultType == 0
    | project
        IPAddress,
        SourceSystem,
        SigniningTime= TimeGenerated,
        OperationName,
        ResultType,
        ResultDescription,
        AlternateSignInName,
        AppDisplayName,
        AuthenticationRequirement,
        ClientAppUsed,
        RiskState,
        RiskLevelDuringSignIn,
        UserPrincipalName=tostring(tolower(UserPrincipalName)),
        Name = tostring(split(UserPrincipalName, "@")[0]),
        UPNSuffix =tostring(split(UserPrincipalName, "@")[1]))
    on $left.DestinationIP == $right.IPAddress and $left.SourceUserName == $right.UserPrincipalName
| where SigniningTime between ((AlertTime - 6h) .. (AlertTime + 6h)) and 3plogTime between ((AlertTime - 6h) .. (AlertTime + 6h))
id: 779731f7-8ba0-4198-8524-5701b7defddc
name: M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity
triggerOperator: gt
metadata:
  source:
    kind: Community
  support:
    tier: Community
  categories:
    domains:
    - Security - Threat Protection
  author:
    name: Arjun Trivedi
query: |
  let Alert_List= dynamic([
  "Phishing link click observed in Network Traffic",
  "Phish delivered due to an IP allow policy",
  "A potentially malicious URL click was detected",
  "High Risk Sign-in Observed in Network Traffic",
  "A user clicked through to a potentially malicious URL",
  "Suspicious network connection to AitM phishing site",
  "Messages containing malicious entity not removed after delivery",
  "Email messages containing malicious URL removed after delivery",
  "Email reported by user as malware or phish",
  "Phish delivered due to an ETR override",
  "Phish not zapped because ZAP is disabled"]);
  SecurityAlert
  | where AlertName in~ (Alert_List)
  //Findling Alerts which has the URL
  | where Entities has "url"
  //extracting Entities
  | extend Entities = parse_json(Entities)
  | mv-apply Entity = Entities on
      (
      where Entity.Type == 'url'
      | extend EntityUrl = tostring(Entity.Url)
      )
  | summarize
      Url=tostring(tolower(take_any(EntityUrl))),
      AlertTime= min(TimeGenerated),
      make_set(SystemAlertId, 100)
      by ProductName, AlertName
  // matching with 3rd party network logs and 3p Alerts
  | join kind= inner (CommonSecurityLog
      | where DeviceVendor has_any  ("Palo Alto Networks", "Fortinet", "Check Point", "Zscaler")
      | where DeviceProduct startswith "FortiGate" or DeviceProduct startswith  "PAN" or DeviceProduct startswith  "VPN" or DeviceProduct startswith "FireWall" or DeviceProduct startswith  "NSSWeblog" or DeviceProduct startswith "URL"
      | where DeviceAction != "Block"
      | where isnotempty(RequestURL)
      | project
          3plogTime=TimeGenerated,
          DeviceVendor,
          DeviceProduct,
          Activity,
          DestinationHostName,
          DestinationIP,
          RequestURL=tostring(tolower(RequestURL)),
          MaliciousIP,
          SourceUserName=tostring(tolower(SourceUserName)),
          IndicatorThreatType,
          ThreatSeverity,
          ThreatConfidence,
          SourceUserID,
          SourceHostName)
      on $left.Url == $right.RequestURL
  // matching successful Login from suspicious IP
  | join kind=inner (SigninLogs
      //filtering the Successful Login
      | where ResultType == 0
      | project
          IPAddress,
          SourceSystem,
          SigniningTime= TimeGenerated,
          OperationName,
          ResultType,
          ResultDescription,
          AlternateSignInName,
          AppDisplayName,
          AuthenticationRequirement,
          ClientAppUsed,
          RiskState,
          RiskLevelDuringSignIn,
          UserPrincipalName=tostring(tolower(UserPrincipalName)),
          Name = tostring(split(UserPrincipalName, "@")[0]),
          UPNSuffix =tostring(split(UserPrincipalName, "@")[1]))
      on $left.DestinationIP == $right.IPAddress and $left.SourceUserName == $right.UserPrincipalName
  | where SigniningTime between ((AlertTime - 6h) .. (AlertTime + 6h)) and 3plogTime between ((AlertTime - 6h) .. (AlertTime + 6h))  
queryPeriod: 1d
requiredDataConnectors:
- connectorId: OfficeATP
  dataTypes:
  - SecurityAlert
- connectorId: PaloAltoNetworks
  dataTypes:
  - CommonSecurityLog (PaloAlto)
- connectorId: Fortinet
  dataTypes:
  - CommonSecurityLog (Fortinet)
- connectorId: CheckPoint
  dataTypes:
  - CommonSecurityLog (CheckPoint)
- connectorId: Zscaler
  dataTypes:
  - CommonSecurityLog (Zscaler)
severity: Medium
queryFrequency: 1d
relevantTechniques:
- T1078
version: 1.0.5
kind: Scheduled
tactics:
- PrivilegeEscalation
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SucessfullSiginFromPhingLink.yaml
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: UserPrincipalName
  - identifier: Name
    columnName: Name
  - identifier: UPNSuffix
    columnName: UPNSuffix
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: DestinationIP
  entityType: IP
- fieldMappings:
  - identifier: DomainName
    columnName: DestinationHostName
  entityType: DNS
- fieldMappings:
  - identifier: FullName
    columnName: SourceSystem
  entityType: Host
- fieldMappings:
  - identifier: Url
    columnName: RequestURL
  entityType: URL
description: |
    'This content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.'
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/779731f7-8ba0-4198-8524-5701b7defddc')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/779731f7-8ba0-4198-8524-5701b7defddc')]",
      "properties": {
        "alertRuleTemplateName": "779731f7-8ba0-4198-8524-5701b7defddc",
        "customDetails": null,
        "description": "'This content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.'\n",
        "displayName": "M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserPrincipalName",
                "identifier": "FullName"
              },
              {
                "columnName": "Name",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DestinationIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DestinationHostName",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "RequestURL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SucessfullSiginFromPhingLink.yaml",
        "query": "let Alert_List= dynamic([\n\"Phishing link click observed in Network Traffic\",\n\"Phish delivered due to an IP allow policy\",\n\"A potentially malicious URL click was detected\",\n\"High Risk Sign-in Observed in Network Traffic\",\n\"A user clicked through to a potentially malicious URL\",\n\"Suspicious network connection to AitM phishing site\",\n\"Messages containing malicious entity not removed after delivery\",\n\"Email messages containing malicious URL removed after delivery\",\n\"Email reported by user as malware or phish\",\n\"Phish delivered due to an ETR override\",\n\"Phish not zapped because ZAP is disabled\"]);\nSecurityAlert\n| where AlertName in~ (Alert_List)\n//Findling Alerts which has the URL\n| where Entities has \"url\"\n//extracting Entities\n| extend Entities = parse_json(Entities)\n| mv-apply Entity = Entities on\n    (\n    where Entity.Type == 'url'\n    | extend EntityUrl = tostring(Entity.Url)\n    )\n| summarize\n    Url=tostring(tolower(take_any(EntityUrl))),\n    AlertTime= min(TimeGenerated),\n    make_set(SystemAlertId, 100)\n    by ProductName, AlertName\n// matching with 3rd party network logs and 3p Alerts\n| join kind= inner (CommonSecurityLog\n    | where DeviceVendor has_any  (\"Palo Alto Networks\", \"Fortinet\", \"Check Point\", \"Zscaler\")\n    | where DeviceProduct startswith \"FortiGate\" or DeviceProduct startswith  \"PAN\" or DeviceProduct startswith  \"VPN\" or DeviceProduct startswith \"FireWall\" or DeviceProduct startswith  \"NSSWeblog\" or DeviceProduct startswith \"URL\"\n    | where DeviceAction != \"Block\"\n    | where isnotempty(RequestURL)\n    | project\n        3plogTime=TimeGenerated,\n        DeviceVendor,\n        DeviceProduct,\n        Activity,\n        DestinationHostName,\n        DestinationIP,\n        RequestURL=tostring(tolower(RequestURL)),\n        MaliciousIP,\n        SourceUserName=tostring(tolower(SourceUserName)),\n        IndicatorThreatType,\n        ThreatSeverity,\n        ThreatConfidence,\n        SourceUserID,\n        SourceHostName)\n    on $left.Url == $right.RequestURL\n// matching successful Login from suspicious IP\n| join kind=inner (SigninLogs\n    //filtering the Successful Login\n    | where ResultType == 0\n    | project\n        IPAddress,\n        SourceSystem,\n        SigniningTime= TimeGenerated,\n        OperationName,\n        ResultType,\n        ResultDescription,\n        AlternateSignInName,\n        AppDisplayName,\n        AuthenticationRequirement,\n        ClientAppUsed,\n        RiskState,\n        RiskLevelDuringSignIn,\n        UserPrincipalName=tostring(tolower(UserPrincipalName)),\n        Name = tostring(split(UserPrincipalName, \"@\")[0]),\n        UPNSuffix =tostring(split(UserPrincipalName, \"@\")[1]))\n    on $left.DestinationIP == $right.IPAddress and $left.SourceUserName == $right.UserPrincipalName\n| where SigniningTime between ((AlertTime - 6h) .. (AlertTime + 6h)) and 3plogTime between ((AlertTime - 6h) .. (AlertTime + 6h))\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.5",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}